Team sync

Embed
Preview of the card
<a href="https://forumulate.com/p/watchtower/docs/team-sync"><img src="https://forumulate.com/api/public/orgs/watchtower/spaces/docs/pages/53ffe91d-2df4-4b89-b176-71c6314b89e0/social-card.svg?v=3e7ae33eec8b" alt="Team sync" width="600" height="315"></a>

Mirror GitHub org teams or ServiceNow assignment groups into Watchtower org teams.

  • POST /v1/orgs/{org}/team-syncs with {kind, config, secret, mapping?, prune?} (needs manage_members). GitHub: config {org, api_base?}, secret {token}, optional mapping of GitHub login to email for members with a private profile email. ServiceNow: config {instance_url}, secret {token} or {user, password}.

  • GET /v1/orgs/{org}/team-syncs[/{id}], DELETE /v1/orgs/{org}/team-syncs/{id}, POST /v1/orgs/{org}/team-syncs/{id}/run (runs on the janitor's next tick).

  • The credential is sealed, never returned and never written to audit events. Source URLs must be https and pass the SSRF guard.

  • The janitor runs due syncs every 15 minutes. Members are matched to org users by email (case-insensitive); people without an account in the org are skipped.

  • Additive by default. With prune: true, members of a synced team that the source no longer lists are removed. Teams the sync created stay when the sync is deleted.

  • Every run that changes something is audited as team_sync.apply.

  • Limit: 10 syncs per org; GitHub runs read at most 50 teams and 500 profile lookups.

Updated